Cyber Threat Intel Daily Briefing — 2026-10-29

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-29 12:15 UTC · REPORT BRIEF-20261029-121535

OPEN // LE

01

New Cisco firewall zero-day exploited to crash SSL VPN devices

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. […]

SRC: BleepingComputer Thu, 29 Oct 2026 07:10:13 -0400 https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/

02

Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls

Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS sco

SRC: The Hacker News Thu, 29 Oct 2026 16:14:46 +0530 https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html

03

Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The

SRC: Security Affairs Thu, 29 Oct 2026 10:34:54 +0000 https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html

04

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 29 Oct 2026 10:29:25 +0000 https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/

05

Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists

The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online. The post Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists appeared first on CyberScoop.

SRC: CyberScoop Wed, 28 Oct 2026 21:33:00 +0000 https://cyberscoop.com/dhs-employee-data-leak-ddosecrets/

06

Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars

SRC: Security Affairs Wed, 28 Oct 2026 20:19:06 +0000 https://securityaffairs.com/201960/cyber-crime/hive-and-nefilim-ransomware-affiliate-gets-70-months-in-jail.html

07

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

SRC: SecurityWeek Wed, 28 Oct 2026 15:05:06 +0000 https://www.securityweek.com/ukrainian-hive-and-nefilim-ransomware-affiliate-gets-70-months-in-us-prison/

08

Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes

The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.

SRC: DarkReading Thu, 29 Oct 2026 10:00:00 GMT https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes

09

Officials seize domain of top bulletproof hosting provider Virtualine

The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers. The post Officials seize domain of top bulletproof hosting provider Virtualine appeared first on C

SRC: CyberScoop Thu, 29 Oct 2026 00:38:19 +0000 https://cyberscoop.com/virtualine-bulletproof-hosting-provider-seized/

10

Researchers uncover Volt Typhoon’s covert, ephemeral network

The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. The post Researchers uncover Volt Typhoon’s covert, ephemeral network appeared first on CyberScoop.

SRC: CyberScoop Wed, 28 Oct 2026 16:00:00 +0000 https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/

11

Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on the

SRC: Security Affairs Wed, 28 Oct 2026 14:37:21 +0000 https://securityaffairs.com/201947/intelligence/ads-or-surveillance-researchers-flag-suspicious-targeting-of-starlink-users.html

12

Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records. The post Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 29 Oct 2026 11:00:00 +0000 https://www.securityweek.com/hackers-steal-2-6-million-records-from-sonys-japanese-isp-so-net/

13

ENGIE Data Breach Exposes Customer Details and Energy Contracts

ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected. French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business p

SRC: Security Affairs Thu, 29 Oct 2026 08:53:37 +0000 https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html

14

HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications. The post HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 29 Oct 2026 08:27:16 +0000 https://www.securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/

15

Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

SRC: DarkReading Wed, 28 Oct 2026 14:37:52 GMT https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials

16

GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitH

SRC: The Hacker News Thu, 29 Oct 2026 15:56:33 +0530 https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html

17

Election Website Security: 42% of US County Sites Still Lack .gov Domains

US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new stu

SRC: Security Affairs Thu, 29 Oct 2026 09:21:41 +0000 https://securityaffairs.com/201967/security/election-website-security-42-of-us-county-sites-still-lack-gov-domains.html

18

GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub

The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.

SRC: DarkReading Wed, 28 Oct 2026 19:39:00 GMT https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github

19

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update

SRC: The Hacker News Wed, 28 Oct 2026 22:38:09 +0530 https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html

20

Cyber Vulnerabilities Besiege Italy, Absent Clear Cause

Researchers can't quite explain why cyber threats look so different in Italy compared to everywhere else.

SRC: DarkReading Thu, 29 Oct 2026 08:00:00 GMT https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy

21

Windows 11 KB5127936 update released with 41 changes and fixes

Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. […]

SRC: BleepingComputer Thu, 29 Oct 2026 08:00:07 -0400 https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127936-update-released-with-41-changes-and-fixes/

22

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the go

SRC: Security Affairs Thu, 29 Oct 2026 08:45:21 +0000 https://securityaffairs.com/202002/cyber-crime/virtualine-domain-seized-but-allegedly-abusive-website-remains-online.html

23

Upwind raises $400M after walking away from Datadog acquisition offer

The cloud security startup raised a Series C at a $3.8B valuation, instead of selling itself for the same price.

SRC: TechCrunch Security Wed, 28 Oct 2026 23:15:00 +0000 https://techcrunch.com/2026/10/28/upwind-raises-400m-after-walking-away-from-datadog-acquisition-offer/

[ SOURCE ] OpenPhish (18 indicator(s))